# Test overlapping P2S identity matches against policy-group priority

> Verify both matched and default address-pool assignments.

- Canonical URL: https://update.dsesecurity.com/updates/dse-20260917-076-test-overlapping-p2s-identity-matches-against-policy-group-priority/
- Publisher: Detection Systems & Engineering (DSE Security)
- Author: DSE Security Editorial Team
- Published: 2026-09-17T16:33:44+00:00
- Modified: 2026-09-17T16:38:45+00:00
- Last reviewed by DSE: 2026-09-17
- Resource type: Guide
- DSE priority: Information
- Topics: Cybersecurity, Networks & Infrastructure
- Reading time: 1 minutes

## What you need to know

Verify both matched and default address-pool assignments.

## Potentially affected

Review this behavior when implementing identity-based P2S pool selection. Identify the configured authentication type, matching attributes, policy priorities and default policy. Validate pool eligibility and non-overlap against the complete current source before creating the configuration.

## DSE recommendation

DSE recommends a small assignment matrix with a single-match user, an authorized user matching multiple groups, and an authorized user matching none.

## Article

## Source facts

Microsoft’s P2S user-group procedure evaluates matching policy groups in priority order and assigns an address from the associated pool. A user who matches none receives an address from the default pool. Policy members describe authentication attributes used for matching, rather than representing individual user records. [Microsoft Learn](https://learn.microsoft.com/en-us/azure/vpn-gateway/point-to-site-user-groups-create-portal).

## Applicability

Review this behavior when implementing identity-based P2S pool selection. Identify the configured authentication type, matching attributes, policy priorities and default policy. Validate pool eligibility and non-overlap against the complete current source before creating the configuration.

## DSE recommendation

DSE recommends a small assignment matrix with a single-match user, an authorized user matching multiple groups, and an authorized user matching none. Specify the intended winning policy and pool for each. Review group membership and priority changes together, since the acceptance question is the resulting address assignment. Preserve the previous configuration and responsible owner with the change.

## Verification

Connect the approved test identities and record assigned addresses against the matrix. Confirm the default case explicitly. Repeat the multi-match case after a controlled priority change, if that change is part of the plan. Keep authentication success separate from evidence that the expected pool supplied the address, and resolve mismatches before wider rollout.

## Official references

[Microsoft Learn: Assign Users IP Addresses from Defined Pools for P2S VPN Connections – Azure portal](https://learn.microsoft.com/en-us/azure/vpn-gateway/point-to-site-user-groups-create-portal).

## Primary reference

- Name: Assign Users IP Addresses from Defined Pools for P2S VPN Connections - Azure portal - Azure VPN Gateway | Microsoft Learn
- Authority: Microsoft Learn
- URL: https://learn.microsoft.com/en-us/azure/vpn-gateway/point-to-site-user-groups-create-portal
- Source publication date: Not stated by the source

## Citation and use

Preferred citation: “Test overlapping P2S identity matches against policy-group priority,” DSE Security, https://update.dsesecurity.com/updates/dse-20260917-076-test-overlapping-p2s-identity-matches-against-policy-group-priority/
Publishing principles: https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/
Usage and citation policy: https://update.dsesecurity.com/usage/
Copyright © 2026 Detection Systems & Engineering. All rights reserved.